This is an automated email from the ASF dual-hosted git repository. lukaszlenart pushed a commit to branch WW-5675-share-parsed-ognl-security-config in repository https://gitbox.apache.org/repos/asf/struts.git
commit ae41c5a8dbbcceac4f9af820f67c2022435a7fea Author: Lukasz Lenart <[email protected]> AuthorDate: Fri Aug 14 14:53:44 2026 +0200 WW-5675 test(ognl): cover the production registration of the config bean Co-Authored-By: Claude Opus 5 <[email protected]> --- ...mberAccessConfigProductionRegistrationTest.java | 43 ++++++++++++++++++++++ .../SecurityMemberAccessConfigSharingTest.java | 6 +++ 2 files changed, 49 insertions(+) diff --git a/core/src/test/java/org/apache/struts2/ognl/SecurityMemberAccessConfigProductionRegistrationTest.java b/core/src/test/java/org/apache/struts2/ognl/SecurityMemberAccessConfigProductionRegistrationTest.java new file mode 100644 index 000000000..cd1018d50 --- /dev/null +++ b/core/src/test/java/org/apache/struts2/ognl/SecurityMemberAccessConfigProductionRegistrationTest.java @@ -0,0 +1,43 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.struts2.ognl; + +import org.apache.struts2.StrutsInternalTestCase; + +/** + * Covers the {@code struts-beans.xml} registration of {@link SecurityMemberAccessConfig}, which + * {@link SecurityMemberAccessConfigSharingTest} cannot: that test extends {@link org.apache.struts2.XWorkTestCase} + * directly, whose container is built from {@code StrutsDefaultConfigurationProvider} alone and never loads + * {@code struts-beans.xml}. Production, via {@link org.apache.struts2.dispatcher.Dispatcher#init()}, never adds + * that provider and relies entirely on the {@code struts-beans.xml} entry. + * <p> + * {@link StrutsInternalTestCase} boots a real {@link org.apache.struts2.dispatcher.Dispatcher}, so its container + * is wired the way production's is. Without this test, the singleton scope of the {@code struts-beans.xml} + * entry — the entire point of WW-5675 sharing parsed configuration across {@link SecurityMemberAccess} + * instances — could regress to {@code scope="prototype"} with the whole suite staying green. + */ +public class SecurityMemberAccessConfigProductionRegistrationTest extends StrutsInternalTestCase { + + public void testConfigBeanIsASingletonInTheProductionContainer() { + SecurityMemberAccessConfig first = container.getInstance(SecurityMemberAccessConfig.class); + assertNotNull("SecurityMemberAccessConfig is not registered in the production container", first); + assertSame("SecurityMemberAccessConfig is not a singleton in the production container", + first, container.getInstance(SecurityMemberAccessConfig.class)); + } +} diff --git a/core/src/test/java/org/apache/struts2/ognl/SecurityMemberAccessConfigSharingTest.java b/core/src/test/java/org/apache/struts2/ognl/SecurityMemberAccessConfigSharingTest.java index eb09c9fb4..ffce445f8 100644 --- a/core/src/test/java/org/apache/struts2/ognl/SecurityMemberAccessConfigSharingTest.java +++ b/core/src/test/java/org/apache/struts2/ognl/SecurityMemberAccessConfigSharingTest.java @@ -162,6 +162,12 @@ public class SecurityMemberAccessConfigSharingTest extends XWorkTestCase { assertTrue("dev-mode exclusions were not applied at startup", excluded.contains("java.lang.ProcessBuilder")); + // The `contains` check above is non-vacuous only because the test container does not load + // struts-excluded-classes.xml, where java.lang.ProcessBuilder happens to sit in both the + // production and dev-mode excluded-classes sets. Asserting identity with the config bean's + // set keeps this test meaningful even if the harness starts loading that file. + assertSame("excludedClasses was not seeded from the dev-mode-resolved config", + container.getInstance(SecurityMemberAccessConfig.class).getExcludedClasses(), excluded); } public void testDevModeMethodsAreGone() throws Exception {
